Executive brief
Apple's Containerization library contains a vulnerability in how it validates token endpoints when communicating with container registries. A remote attacker controlling a registry can redirect credential requests to any host they choose, potentially exfiltrating authentication tokens and credentials. This could compromise access to internal services and private registries across an organization.
Technical details
The vulnerability exists in the `RegistryClient` component's handling of HTTP 401/403 responses containing `WWW-Authenticate: Bearer` challenges. The client extracts the `realm` parameter from the challenge and uses it as a token endpoint URL without validating the host or scheme. An attacker controlling a container registry can supply a malicious realm value pointing to any network-accessible host, causing the client to send configured credentials to that destination. The attack requires only a client operation contacting the attacker's registry (including failed login attempts), and enables server-side request forgery (SSRF), token exfiltration from internal services, and cleartext credential exposure over HTTP. The vulnerability is fixed in version 0.41.0 and later.
Affected products
- Apple Containerization <= 0.41.0
Timeline
- 2026-08-30: disclosed
- 2026-09-16: patched: Fixed in version 0.41.0